No abstract

No abstract

Web vulnerability scanners (WVSs) are tools that can detect security vulnerabilities in web services. Although both commercial and open-source WVSs exist, their vulnerability detection capability and performance vary. In this paper, we report on a comparative study to determine the vulnerability detection capabilities of eight WVSs (both open and commercial) using two vulnerable web applications: WebGoat and Damn vulnerable web application (DVWA). The eight WVSs studied were: Acunetix; HP WebInspect; IBM AppScan; OWASP ZAP; S ; Arachni; Vega; and Iron WASP. The performance was evaluated using multiple evaluation metrics: precision; recall; Youden index; OWASP web benchmark evaluation (WBE); and the web application security scanner evaluation criteria (WASSEC). The experimental results show that, while the commercial scanners are effective in detecting security vulnerabilities, some open-source scanners (such as ZAP and Skipfish) can also be effective. In summary, this study recommends improving the vulnerability detection capabilities of both the open-source and commercial scanners to enhance code coverage and the detection rate, and to reduce the number of false-positives.

Software vulnerability remains a serious problem among industry players in the world today because of the numerous security related challenges it possess to end-users and stakeholders. Although previous studies have proposed various methods and tools that can be used in reducing or eliminating software vulnerability, those studies, however, raised several additional questions that need be addressed: (1) Can all the tools be used in curbing software vulnerabilities.(2) Can a specific tool detect all software vulnerabilities? To address these questions, we performed a detailed evaluation of the various software vulnerability detection methods and tools to find out their differences and similarities. Our studies also seeks to investigate the most efficient approach for detecting vulnerabilities based on previously proposed benchmarks and present some recommendations for future studies.